Quick answers
- Is CVE-2022-0766 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-0766 being exploited in the wild.
- How severe is CVE-2022-0766?
- Critical severity, with a CVSS score of 9.8, published 8 March 2022.
- Which products and versions are affected?
- calibreweb (PyPI) < 0.6.17, ECOSYSTEM:introduced=0,fixed=0.6.17.
- Is there a fix for CVE-2022-0766?
- Yes. calibreweb (PyPI): upgrade to 0.6.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2022-0766 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2022-0766?
- Check whether you run calibreweb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- calibreweb (PyPI): upgrade to 0.6.17 or later
pip install "calibreweb>=0.6.17"
Technical details
calibreweb prior to version 0.6.17 contains an incomplete fix for a prior SSRF vulnerability (CVE-2022-0339). The blacklist used to block requests to localhost and internal addresses fails to block the IP address 0.0.0.0, which resolves to localhost on many systems. An attacker can supply a malicious URL containing 0.0.0.0 in the cover upload functionality to bypass the blacklist and access internal services. This is a network-reachable vulnerability requiring no authentication or user interaction beyond requesting a cover upload. An attacker can use this to perform SSRF attacks against internal services, metadata servers, or cloud metadata endpoints.
Affected products
- calibreweb calibreweb before 0.6.17
Identifiers
- CVE-2022-0766
- GHSA-2647-c639-qv2j
- PYSEC-2026-304
Timeline
- 2022-03-08: disclosed
- 2022-03-08: patched: Fixed in version 0.6.17